Elaborate 'pharming' attack shut down

Customers of 50 banks worldwide targets

Security researchers are working to shut down a hacking attack targeting Internet banking users of at least 50 financial institutions in Europe and the US.

The attack was notable for the extra effort put into it by the hackers, who constructed a separate look-alike website for each financial institution they targeted, said Henry Gonzalez, senior security researcher for Websense.

To be infected, a user had to be lured to a website that hosted malicious code exploiting a critical vulnerability revealed last year in Microsoft's software, Websense said.

The vulnerability, for which Microsoft had issued a patch, is particularly dangerous since it requires a user merely to visit a website rigged with the malicious code.

Once lured to the site, an un-patched computer would download a Trojan horse in a file called "iexplorer.exe," which then downloads five additional files from a server in Russia. The websites displayed only an error message and recommended that the user shut off their firewall and antivirus software.

If a user with an infected PC then visited any of the targeted banking sites, they were redirected to a mock-up of the bank's website that collected their login credentials and transferred them to the Russian server, Gonzalez said. The user was then passed back to the legitimate site where they were already logged in, making the attack invisible.

The technique is known as a ‘pharming’ attack. Like phishing attacks, pharming involves the creation of look-alike websites that fool people into giving away their personal information. But where phishing attacks encourage victims to click on links in spam messages to lure them to the look-alike site, pharming attacks direct the victim to the look-alike site even if they type the address of the real site into their browser.

The websites hosting the malicious code, which were located in Germany, Estonia and the UK, had been shut down by internet service providers (ISPs) as of Thursday morning, along with the look-alike websites, Gonzalez said.

It was unclear how many people may have fallen victim to the attack, which went on for at least three days. Websense did not hear of people losing money from accounts, but "people don't like to make it public if it ever happens," Gonzalez said.

The attack also installed a "bot" on users' PCs, which gave the attacker remote control of the infected machine. Through reverse engineering and other techniques, Websense researchers were able to capture screenshots [http://www.websense.com/securitylabs/alerts/alert.php?AlertID=743] of the bot controller.

The controller also shows infection statistics. Websense said at least 1,000 machines were being infected per day, mostly in the US and Australia.